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ABSTRACT 

The  Naval  Postgraduate  School's  Space  Systems  Academic  Group  is 
developing  a  satellite-based  experiment  to  evaluate  the  electrical  properties 
of  ferroelectric  capacitors  under  high  levels  of  ionizing  particle  radiation. 
The  experiment,  called  FERRO,  is  one  of  three  experiments  that  comprise 
the  APEX  mission.    The  Apex  mission  is  sponsored  by  the  joint  Space  Test 
Program  and  will  be  launched  in  early  1993.    The  main  processor  for  FERRO 
is  an  Intel  80C196KB  16-bit  embedded  controller  that  will  perform  all 
aspects  of  experiment  control,  data  acquisition,  and  communication  with  the 
host  satellite  processor.    The  design  of  systems  and  communications 
software  to  support  the  experiment  is  presented.    Functional  areas 
addressed  by  the  design  include:    microcontroller  and  peripheral 
initialization;    communication  between  the  experiment  and  spacecraft 
processors;    fault  detection/recovery;    recovery  from  loss  of  power;    and 
development  of  an  IBM  PC  based  program  to  provide  for  pre-flight 
verification  and  testing  of  experiment  hardware  and  software. 
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I.  INTRODUCTION 

A.  PURPOSE 

The  Naval  Postgraduate  School's  Space  Systems  Academic  Group  is 
developing  a  satellite-based  experiment  to  evaluate  the  electrical  properties 
of  ferroelectric  capacitors  in  a  space  environment.    Although  ferroelectric 
devices  have  undergone  radiation  testing  in  artificial  environments,  actual 
testing  in  space  is  necessary  to  assure  the  suitability  of  these  devices  for 
space  applications.    The  purpose  of  this  thesis  is  to  develop  microcontroller 
software  to  conduct  the  experiment,  collect  data,  and  provide  for 
communication  between  the  spacecraft  and  experiment  processors. 

B.  BACKGROUND 

1.       APEX  Mission 

The  experiment,  called  FERRO,  is  scheduled  for  launch  aboard  a 
joint  Department  of  Defense  (DOD)  spacecraft  in  March  1993.    FERRO  is 
one  of  three  independent  experiments  that  make  up  the  Advanced 
Photovoltaic  and  Electronics  Experiment  (APEX)  mission.    The  mission  is 
sponsored  by  the  joint  Space  Test  Program  under  the  management  of  the 
U.S.  Air  Force. 

The  objective  of  the  APEX  mission  is  to  collect  data  concerning 
the  effects  of  a  high  radiation  environment  on  selected  electronic 
components.    To  meet  this  objective,  three  experiments  will  be  placed  in  a 


low-earth,  near-polar  orbit  for  a  minimum  mission  life  of  one  year  and  a  goal 
of  three  years. 

The  principal  experiment  is  the  Photovoltaic  Array  Space  Power 
Plus  Diagnostics  (PASP-PLUS)  developed  by  the  NASA/Goddard  Space 
Flight  Center.    PASP-PLUS  will  determine  the  efficiency  and  performance 
limits  of  advanced  solar  cell  designs  under  stressing  space  environments. 
Second,  is  the  Cosmic  Ray  Upset  Experiment  (CRUX)  developed  by  the  Air 
Force  Geophysics  Laboratory.    CRUX  will  develop  data  to  validate  and 
update  analytical  models  used  to  determine  the  effects  of  high  energy 
cosmic  rays  and  trapped  protons  on  space-borne  semiconductor 
components.    FERRO  is  the  third  and  smallest  of  the  experiments  and  will 
determine  the  performance  of  ferroelectric  capacitor  test  devices  exposed  to 
long  periods  of  radiation  and  high  stressed  operation. 

The  APEX  spacecraft  (Figure  1)  is  based  on  the  PegaStar 
integrated  spacecraft  bus  for  the  Pegasus  launch  vehicle  developed  by 
Orbital  Sciences  Corporation  (OSC).    Integration  and  system  level  testing  of 
the  bus,  launch  vehicle,  and  APEX  subsystems  will  take  place  at  OSC's 
Systems  Integration  Laboratory  at  NASA  Ames-Dryden  Flight  Research 
Facility  [Ref.  1]. 

The  APEX  spacecraft  will  be  placed  in  a  polar  elliptical  orbit  with  a 
target  inclination  of  70°,  + 10°/-0°  that  will  provide  periodic  exposure  to 
the  lower  Van  Allen  radiation  belt.    Target  parameters  for  initial  perigee  and 
apogee  were  selected  to  provide  a  190  ±10  nmi  perigee  and  a  1054  ±100 
nmi  apogee  over  the  mission  lifetime.  [Ref.  1;  p.  16] 
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Figure  1.   APEX  Spacecraft  and  Payload  Layout  [Ref.  1] 


2.       Ferroelectric  Devices 

A  ferroelectric  material  is  one  that  is  polarized  by  the  application 
of  an  electric  field  and  that  maintains  a  remanent  polarization  after  removal 
of  the  exciting  field.    Early  bulk  or  thick-film  ferroelectric  devices  required 
excessive  voltages  to  switch  polarization  states,  but  recent  advances  in 
thin-film  technology  have  made  the  use  of  ferroelectric  devices  practical. 

Thin-film  ferroelectric  capacitors  have  been  the  subject  of 
considerable  research  over  the  past  decade  due  to  the  highly  desirable 
properties  these  devices  exhibit  with  respect  to  memory  applications.  These 
properties  include  nonvolatility,  radiation-hardness,  low  power  consumption, 
high  speed,  high  switching  endurance,  and  high  component  density. 

Ferroelectric  devices  have  significant  advantages  over 
conventional  nonvolatile  semiconductor  memory  technology  in  many  of 
these  areas  and  this  superiority  makes  ferroelectric  memory  a  natural  choice 
for  space-borne  and  military  applications  as  well  as  for  more  conventional 
commercial  applications.  [Ref.  2] 

a.       Bistable  Polarization 

A  basic  characteristic  of  ferroelectric  capacitors  is  the 
hysteretic  behavior  relating  polarization,  P,  and  the  applied  electric  field,  E, 
as  shown  in  Figure  2    below.  [Ref.  3]    As  the  intensity  of  the  electric  field  is 
increased,  the  polarization  increases  until  saturation  is  reached  at  Ps.  If  the 
electric  field  is  subsequently  removed,  a  remanent  polarization,  Pr,  remains. 
When  the  polarity  of  the  electric  field  is  reversed,  similar  characteristics  but 
of  opposite  polarity  are  exhibited.   The  two  zero-field  values  of  remanent 


polarization,  ±Pr,  are  equally  stable  and  thus  result  in  the  ability  to  provide 
nonvolatile  storage  of  binary  information. 
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Figure  2.   Polarization  versus  Applied  Electric  Field  [Ref.  4] 


b.       Fatigue  and  Ageing 

Ferroelectric  devices  are  affected  by  two  primary  forms  of 
functional  degradation:    fatigue  and  ageing.    Standard  definitions  of  these 
terms  have  not  yet  been  established,  so  working  definitions  for  the  purpose 
of  this  discussion  will  be  described  below. 

Fatigue  is  defined  as  the  symmetric  loss  in  remanent 
polarization  that  results  from  repeated  application  of  electric  fields  [Ref.  4]. 
The  fatiguing  effect  results  in  vertical  compression  of  the  hysteresis  loop  as 
shown  in  Figure  3.    Periodic  alternating  electric  fields  are  often  intentionally 


applied  to  ferroelectric  materials  to  establish  a  measure  of  the  material's 
"fatigue  limit"  or  the  point  at  which  the  performance  of  the  device  is 
seriously  degraded. 

Ageing  is  defined  as  the  symmetric  or  asymmetric  loss  in 
remanent  polarization  that  occurs  under  conditions  of  zero  applied  electric 
field  following  an  initial  polarization  of  the  material  [Ref.  4].    The  original 
polarization  levels  may  sometimes  be  restored  by  cycling  the  device  through 
many  polarization  reversals  by  applying  an  alternating  electric  field  [Ref.  5  ]. 


Figure  3.   Effect  of  Fatiguing  [Ref.  4] 


Experiments  to  measure  the  effects  of  ageing  usually  consist 
of  polarizing  the  device  and  waiting  for  a  specified  time  before  measuring 
the  remanent  polarization.    Since  the  effects  of  fatiguing  and  ageing  are 


similar,  tests  to  measure  the  effects  of  each  phenomenon  are  usually 
conducted  independently. 

c.       Measuring  Polarization 

Polarization,  unlike  voltage  or  current,  cannot  be  measured 
directly.    The  Sawyer-Tower  circuit  shown  in  Figure  4  provides  a  simple 
method  for  the  indirect  measurement  of  polarization  of  ferroelectric 
capacitors  [Ref.  6:  p.  270,  Figure  1].    The  Sawyer-Tower  circuit  consists  of 
an  integrating  or  sense  capacitor  placed  in  series  with  the  ferroelectric 
capacitor.    The  value  of  the  sense  capacitor,  Cs,  is  normally  chosen  to  be 
four  to  five  times  the  capacitance  of  the  ferroelectric  capacitor. 
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Figure  4.   The  Sawyer-Tower  Circuit  [Ref.  4:  p.  19] 

The  charge,  q,  on  the  upper  plate  of  the  sense  capacitor,  Cs, 
(Figure  4)  can  be  calculated  from 

q  =  CSV2  (1) 

where  Cs  is  the  capacitance  of  the  sense  capacitor.    Since  this  charge  is 
equal  and  opposite  to  the  charge  on  the  lower  plate  of  the  ferroelectric 


capacitor,    the  polarization,  P,  of  the  ferroelectric  capacitor  can  be 
calculated  from 

q 
P  =  A  (2> 

where  A  is  the  cross-sectional  area  of  the  ferroelectric  capacitor.    Thus,  by 

combining  equations  (1)  and  (2),  the  polarization  of  the  ferroelectric 

capacitor  can  easily  be  determined  by  measuring  V2.    l[Ref.  4:  p.  20] 

Unfortunately,  connecting  measurement  equipment  to  the 
Sawyer-Tower  circuit  will  affect  the  charge  distribution,  thereby  making  the 
measurement  invalid.    This  makes  it  impractical  to  determine  the  state  of  the 
ferroelectric  capacitor  statically  as  described  above.    Instead,  a  method 
involving  the  application  of  a  "read  pulse"  to  the  Sawyer-Tower  circuit  is 
used.    This  method  will  be  explained  in  detail    in  the  discussion  that  follows. 

Independent  of  their  ferroelectric  effects,  ferroelectric 
capacitors  have  the  properties  of  standard  dielectric  capacitors.    When  an 
electric  field  is  applied  to  the  capacitor,  a  charging  current  flows  that  is 
proportional  to  the  dielectric  constant  of  the  material.    If  the  polarization  of 
the  ferroelectric  capacitor  before  applying  the  electric  field  is  in  the  same 
direction  as  the  field,  only  this  charging  current  will  flow. 

If  the  ferroelectric  capacitor  was  polarized  opposite  the 
electric  field,  a  larger  current  flows  that  is  the  sum  of  the  charging  current 
of  the  capacitor  and  the  switching  current  caused  by  reversing  the  polarity 
of  the  ferroelectric  material.    Thus  the  polarization  state  of  the  capacitor 
before  application  of  the  electric  field  can  be  determined  by  the  amount  of 
current  flow  through  the  capacitor  when  the  field  is  applied.    It  should  be 
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noted  that  the  ferroelectric  capacitor  will  be  polarized  in  the  direction  of  the 
applied  field  after  the  read  operation.    Therefore,  similar  to  the  operation  of 
dynamic  RAM,  reading  the  state  of  the  capacitor  destroys  the  information 
stored  in  the  capacitor.  [Ref.  7:  p.  213] 

Figure  5  shows  the  current  through  a  ferroelectric  capacitor 
for  the  four  possible  conditions.    Note  that  the  capacitor  is  polarized  in  the 
negative  direction  before  the  pulse  train  is  applied.    When  voltage  pulse  P  is 
applied,  a  polarization  reversal  is  caused  resulting  in  a  larger  current  pulse. 
Pulse  U  causes  no  polarization  reversal  and  only  the  smaller  charging  current 
flows  as  illustrated  by  curve  U. 
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Figure  5.   Current  Output  for  Ferroelectric  Capacitor  [Ref.  7:  p.  213] 
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Similar  results  occur  for  the  negative  pulses  as  shown  by 
curves  N  and  D.    If,  due  to  fatigue  or  ageing,  the  ferroelectric  capacitor  is 
not  fully  polarized  in  a  given  direction,  the  current  pulse  will  lie  somewhere 
between  the  P  and  U  or  N  and  D  curves. 

When  such  pulses  are  applied  to  a  Sawyer-Tower  circuit 
arranged  as  previously  discussed,  the  sense  capacitor  will  integrate  the 
current  pulse  and  the  voltage  V2  (Figure  4)  will  be  proportional  to  the  area 
under  the  appropriate  curve  as  shown  in  Figure  5.    Thus  by  measuring  the 
voltage  across  the  sense  capacitor,  it  is  possible  to  determine  the 
polarization  state  of  the  ferroelectric  capacitor.    A  fixed  reference  direction 
(positive  or  negative)  for  all  read  pulses  is  normally  chosen. 

It  should  be  noted  that  the  Sawyer-Tower  circuit  is  used  only 
for  reading  the  polarization  state  of  the  ferroelectric  capacitor.    The  sense 
capacitor  should  be  switched  out  of  the  circuit  when  an  electric  field  is 
applied  to  polarize  the  ferroelectric  capacitor  in  a  given  direction. 
Additionally,  the  sense  capacitor  should  be  in  a  fully  discharged  state  before 
being  connected  to  the  ferroelectric  capacitor.    Both  requirements  are  easily 
met  by  simply  grounding  the  sense  node  when  polarizing  or  writing  to  the 
ferroelectric  capacitor,  and  removing  the  ground  when  reading. 
3.       The  FERRO  Experiment 

The  objective  of  the  FERRO  experiment  is  to  measure  the  fatigue 
and  ageing  response  of  integrated  ferroelectric  capacitors  as  they 
experience  high  levels  of  ionizing  particle  radiation.    FERRO  contains  a  total 
of  32  ferroelectric  capacitors  divided  into  four  groups  of  eight  referred  to  as 
devices  under  test  (DUTs).   Two  DUTs  will  serve  as  the  test  group.    They 
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will  be  located  outside  the  shielding  of  the  housing  subsystem  and  receive 
the  maximum  radiation  dose  possible,   the  other  two  DUTs  will  serve  as  the 
control  group  and  reside  inside  the  shielding  of  the  housing  subsystem. 
Each  group  is  further  subdivided  so  that  one  DUT  will  undergo  both  fatigue 
and  ageing  tests,  while  the  other  DUT  will  go  through  only  the  ageing  tests. 
The  experiment  is  executed  in  21 -day  cycles  as  shown  in  Figure  6.    The 
cycles  will  be  repeated  until  the  end  of  the  experiment. 


Figure  6.   FERRO  Experiment  Cycle 

a.       Fatigue/Age  Testing 

One  DUT  from  each  of  the  control  and  test  groups  will 
undergo  a  combination  of  fatigue  and  age  testing.    Three  identical  seven-day 
subcycles  of  fatigue/age  tests  will  occur  each  experiment  cycle.    During  the 
fatigue  phase  of  testing,  a  5  kHz,  10  volt  peak  to  peak  bipolar  squarewave 
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will  be  applied  to  the  DUTs  with  the  sense  capacitor  of  the  Sawyer-Tower 
circuit  switched  out  (sense  node  grounded). 

The  fatigue  phase  will  continue  for  six  days  with  a  short 
pause  every  24  hours  to  polarize  and  then  sample  the  remanent  polarization 
of  each  ferroelectric  capacitor  using  the  Sawyer-Tower  circuit.    Two  data 
points  will  be  collected  for  each  capacitor.    First,  a  negative  pulse  is  used  to 
write  to  the  ferroelectric  capacitor,  followed  by  a  read  using  a  positive 
pulse.    This  data  point  will  provide  a  measure  of  the  negative  remanent 
polarization.    Using  opposite  polarities  for  the  read  and  write  pulses  ensures 
that  polarization  reversal  will  occur  during  the  read  process.    For  the  second 
data  point,  the  polarity  of  the  read  and  write  pulses  are  reversed  to  provide 
a  measure  of  the  positive  remanent  polarization. 

On  the  seventh  day  of  each  fatigue/age  subcycle,  the  DUTs 
will  undergo  ageing  tests  that  are  identical  to  the  ageing  tests  for  the  ageing 
DUTs  described  below,  but  limited  to  24  hours  in  duration.   The  24-hour 
period  of  ageing  tests  will  allow  for  tests  using  the  first  23  time  intervals  of 
Table  1  to  be  completed. 
b.       Ageing  Tests 

The  other  DUT  in  each  of  the  control  and  test  groups  will 
undergo  only  ageing  tests  for  the  21 -day  experiment  cycle.    Each  ageing 
test  will  consist  of  writing  to  the  ferroelectric  capacitors  and  waiting  a 
specified  ageing  time  before  reading  the  capacitors.    The  read  and  write 
pulses  will  be  of  opposite  polarity,  as  in  the  fatigue  testing,  and  the 
polarities  will  be  reversed  each  experiment  cycle.    The  ageing  intervals  for 
the  30  ageing  tests  done  each  experiment  cycle  are  shown  in  table  1 . 
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The  cumulative  time  to  complete  all  30  ageing  tests  is 
approximately  20  days,  7  hours,  but  the  ageing  test  cycle  was  rounded  to 
21  days  to  keep  the  fatigue/ageing  and  ageing  test  cycles  in 
synchronization.  This  also  allows  the  test  events  to  occur  at  fixed  times  in 
relation  to  the  24-hour  clock. 

TABLE  1.   AGEING  INTERVALS  (seconds) 


1 

2 

3 

4 

5 

10 

20 

30 

40 

50 

100 

200 

300 

400 

500 

1,000 

2,000 

3,000 

4,000 

5,000 

10,000 

20,000 

30,000 

40,000 

50,000 

100,000 

200,000 

300,000 

400,000 

500,000 

c.       Data  Collection 

Each  fatigue  or  ageing  measurement  will  be  an  analog 
voltage  that  must  be  converted  and  stored  in  binary  format.    In  addition  to 
the  ferroelectric  capacitor  measurements,  internal  and  external  temperature 
will  be  measured  and  recorded  regularly.   This  data,  along  with  other 
experiment  status  information  will  be  uploaded  to  the  APEX  processor 
periodically.    The  APEX  processor  will  collect  data  from  all  three 
experiments  and  relay  the  data  to  earth.    Radiation  dosimetry  data  will  be 
provided  along  with  the  FERRO  experiment  data. 
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4.       Intel  M80C 196KB  Microcontroller 

The  M80C196KB  16-bit  microcontroller  was  chosen  as  the 
processor  for  the  FERRO  experiment.    Details  of  the  selection  process  are 
discussed  in  Reference  8.    The  M80C196KB  is  a  highly  integrated  single 
chip  device  that  incorporates  many  commonly  used  peripherals.    The 
processor  is  a  member  of  the  CHMOS  branch  of  the  MCS-96  family  and 
shares  a  common  architecture  and  instruction  set  with  other  members  in  the 
family  such  as  the  8096.   The  CHMOS  devices  have  enhancements  to 
provide  higher  performance  at  lower  power  consumption  than  the  other 
devices  in  the  family. 

A  radiation-hard  version  of  the  processor  is  not  available.    While 
there  is  no  data  concerning  radiation  tolerance  or  single-event-upset  rate  for 
the  chip,  the  fabrication  process  used  by  Intel  for  their  military  products  has 
been  shown  to  exhibit  high  total  dose  thresholds  [Ref.  8:  p.  59]. 

A  simplified  block  diagram  of  the  M80C196KB  is  shown  in  Figure 
7.    The  CPU  has  a  register-register  architecture  and  most  operations  can  be 
quickly  performed  from  or  to  any  register.    A  256-byte  register  space 
includes  a  232-byte  general-purpose  register  file  that  can  be  accessed  as 
bytes,  words  (16  bits),  or  double-words  (32  bits).    Control  of  on-chip 
peripherals  is  accomplished  through  Special  Function  Registers  (SFRs), 
which  make  up  the  balance  of  the  register  space. 

On-chip  peripherals  include  a  full  duplex  serial  port,  an  A/D 
converter,  a  pulse-width-modulator, up  to  48  I/O  lines  (depending  upon 
which  peripherals  are  used),  a  high-speed  I/O  subsystem,  two  timers,  and  a 
watchdog  timer. 
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Figure  7.  80C196KB  Block  Diagram  [Ref.  9:  p.  4-1] 
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The  80C196KB  has  an  addressable  memory  space  of  64  Kbytes. 
The  256  bytes  from  OOOOH  through  OOFFH  are  used  for  the  SFRs  and 
register  file,  while  the  locations  between  2000H  and  2080H  are  reserved  for 
interrupt  vectors  and  a  chip  configuration  byte.    A  pin  that  is  asserted  on 
instruction  fetches  is  provided  to  allow  decoding  of  more  than  64  Kbytes  of 
addressing  space.    If  used,  this  signal  will  allow  for  64  Kbytes  of  code  space 
and  64  Kbytes  of  data  space. 

The  80C196KB  can  be  runtime  configured  to  operate  with  either  a 
16-bit  or  8-bit  data  bus.    For  16-bit  bus  cycles,  Ports  3  and  4  contain  the 
address  multiplexed  with  data.    For  8-bit  bus  cycles,  Port  3  is  multiplexed 
with  address  and  data,  while  Port  4  contains  only  the  most  significant  byte 
of  address.    The  bus  width  can  be  changed  every  bus  cycle.    Several  modes 
of  bus  control  are  available  to  match  a  wide  variety  of  external  peripherals. 
This  versatility  reduces  the  external  interface  circuitry  required. 
Additionally,  the  80C196KB  supports  a  bus  exchange  protocol  to  allow 
other  devices  to  gain  and  return  control  of  the  bus. 

a.       Timers 

Two  16-bit  timers  are  available  on  the  80C196KB.    Timerl  is 
a  free-running  timer  that  is  incremented  every  eight  state  times  (sixteen 
system  clock  periods).   Timerl  may  be  used  as  a  reference  for  both  the  HSI 
and  HSO  units.    An  interrupt  can  be  generated  when  the  timer  overflows. 
Timer2  counts  both  positive  and  negative  transitions  on  its 
selected  input.    It  can  be  configured  as  either  an  up  counter  or  down 
counter.    Timer2  can  be  reset  by  hardware,  software,  or  the  HSO  unit. 
Either  Timerl  or  Timer2  may  be  used  as  a  reference  for  the  HSO  unit.    The 
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maximum  transition  speed  is  once  per  state  time  in  Fast  Increment  mode 
and  once  every  eight  states  otherwise.    The  value  of  Timer2  may  be 
captured  into  a  designated  register  by  a  rising  edge  on  an  external  pin.    An 
interrupt  can  be  generated  by  the  capture  operation.    Interrupts  can  also  be 
generated  by  crossing  either  the  OFFFFH/OOOOH  boundary  or  the 
7FFFH/8000H  boundary  in  either  direction. 
b.       High  Speed  Input  Unit 

The  High  Speed  Input  (HSI)  unit,  shown  in  Figure  8,  can 
capture  the  Timerl  value  when  an  event  occurs  on  one  of  four  input  pins. 
Four  types  of  events  may  be  specified:    rising  edge,  falling  edge,  rising  or 
falling  edge,  or  every  eighth  rising  edge.    A  FIFO  and  holding  register  allow 
up  to  eight  events  to  be  recorded  before  they  must  be  read.    The  HSI  unit 
can  generate  interrupts  in  three  ways:    when  a  value  moves  into  the  holding 
register  (i.e.  data  is  available),  when  four  events  have  been  recorded,  or 
when  six  events  have  been  recorded. 
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Figure  8.  High  Speed  Input  Unit  Block  Diagram  [Ref.  9] 
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c.       High  Speed  Output  Unit 

The  High  Speed  Output  (HSO)  unit  can  schedule  and 
generate  events  at  specified  times  based  on  Timerl  or  Timer2.    A  block 
diagram  of  the  HSO  is  shown  in  Figure  9.   These  events  can  be  scheduled 
to  occur  once,  or  to  be  recurrent,  with  minimal  CPU  overhead.    Up  to  eight 
pending  events  can  be  scheduled  and  stored  in  a  Content  Addressable 
Memory  (CAM).    One  CAM  register  is  compared  with  the  timer  values  each 
state  time. 
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Figure  9.  High  Speed  Output  Unit  Block  Diagram  [Ref.  9] 

One  CAM  register  is  checked  each  state  time  to  determine  if 
an  event  should  be  initiated.   The  minimum  time  resolution  of  the  HSO  is 
eight  state  times  since  all  eight  CAM  registers  must  be  checked.    Events 
that  may  be  scheduled  include:    starting  an  A/D  conversion,  resetting 
Timer2,  setting  four  software  timers,  and  switching  six  output  lines. 
Interrupts  can  be  generated  by  any  of  these  events. 
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d.  Serial  Port 

The  80C196KB  provides  an  onboard  serial  port  with  one 
synchronous  mode  and  three  full  duplex  asynchronous  modes.   Two  of  the 
asynchronous  modes  are  designed  for  interprocessor  communications. 
Double  buffering  is  provided  for  both  the  transmitter  and  receiver.    Baud 
rates  are  generated  with  an  independent  15-bit  counter  based  on  either  the 
system  clock  or  the  Timer2  clock. 

The  serial  port  may  generate  one  of  three  maskable 
interrupts:    Transmit  Interrupt  (Tl),  Receive  Interrupt  (Rl),  or  SERIAL.    A 
SERIAL  interrupt  is  generated  on  both  transmit  and  receive  cycles,  while  Tl 
and  Rl  are  generated  on  transmit  and  receive  respectively. 

e.  A/D  Converter 

The  80C196KB's  built-in  A/D  converter  is  shown  in  Figure 
10.    It  consists  of  an  8-channel  multiplexer,  a  sample-and-hold  circuit,  and  a 
10-bit  successive  approximation  analog-to-digital  converter. 

Any  one  of  the  eight  analog  input  pins  (shared  with  Port  0) 
can  be  sampled  under  the  control  of  the  A/D  Command  register. 
Additionally,  the  conversion  process  can  be  scheduled  using  the  High  Speed 
Output  (HSO)  unit.    The  result  is  a  10-bit  binary  representation  of  the  ratio 
of  the  analog  input  voltage  divided  by  the  analog  reference  voltage,  VREF. 

The  conversion  process  can  take  either  91  or  158  state 
times  depending  upon  whether  a  prescaler  bit  is  used.    The  prescaler  is 
necessary  if  higher  clock  speeds  are  used,  to  allow  time  for  the  comparator 
to  settle  during  the  conversion.    An  interrupt  can  be  generated  upon 
completion  of  the  conversion  process. 
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Figure  10.  Analog-to-Digital  Converter  Block  Diagram  [Ref.  9] 

/.        Pulse  Width  Modulator 

The  Pulse  Width  Modulator  (PWM)  generates  a  variable  duty 
cycle  pulse  that  repeats  every  256  or  512  state  times  depending  upon 
whether  a  pre-scaler  (divide  by  2)  is  enabled.    A  block  diagram  of  the  PWM 
circuit  is  shown  in  Figure  11.    An  8-bit  counter  is  incremented  every  state 
time.    When  the  counter  overflows,  the  output  is  set  high,  when  it  matches 
the  PWM  register,  the  output  is  set  low.    The  duty  cycle  of  the  output 
waveform  is  determined  by  the  value  in  the  PWM  register.    Applications  for 
the  PWM  include  generating  motor  drive  control  signals  and  performing 
digital-to-analog  conversion. 
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Figure  11.   Pulse  Width  Modulator  Block  Diagram  [Ref.  9] 

g.       Watchdog  Timer 

The  Watchdog  Timer  allows  for  graceful  recovery  from  a 
software  fault.    When  enabled,  the  watchdog  will  initiate  a  hardware  reset 
unless  the  timer  is  cleared  by  software  before  it  overflows.    The  16-bit  timer 
is  incremented  every  state  time;  thus  the  programmer  must  ensure  that 
under  normal  operation,  the  watchdog  timer  is  cleared  at  intervals  not  to 
exceed  64K  state  times. 
h.       Interrupts 

The  80C196KB  microprocessor  has  28  sources  of  interrupts 
mapped  onto  18  vectors.    Table  2  shows  the  interrupts  and  their  priorities 
with  15  being  the  highest  priority  and  0  the  lowest.    The  interrupts  are 
individually  maskable  with  the  exception  of  the  Nonmaskable  interrupt,  the 
Unimplemented  Opcode  interrupt  and  the  Trap  interrupt.    Interrupts  may  be 
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globally  enabled  or  disabled  by  changing  a  flag  in  the  Program  Status  Word, 
Several  instructions  are  provided  to  control  the  state  of  this  flag. 

TABLE  2.  80C196KB  INTERRUPT  PRIORITIES  [Ref.  8] 


Interrupt  Number 

Source 

Priority 

INT  15 

NMI 

15 

INT  14 

HSI  FIFO  Full 

14 

INT  13 

EXTINT1 

13 

INT  12 

TIMER2  Overflow 

12 

INT  11 

TIMER2  Capture 

11 

INT  10 

4th  Entry  into  HSI  FIFO 

10 

INT  09 

Rl 

9 

INT  08 

Tl 

8 

SPECIAL 

Unimplemented  Opcode 

N/A 

SPECIAL 

Trap 

N/A 

INTO? 

EXTINT 

7 

INT  06 

Serial  Port 

6 

INT  05 

Software  Timer 

5 

INT  04 

HSI  Pin  0 

4 

INT  03 

HSO  Output  Pins 

3 

INT  02 

HSI  Data  Available 

2 

INT  01 

A/D  Conversion  Complete 

1 

INT  00 

Timer  Overflow 

0 

When  an  interrupt  is  detected,  the  corresponding  bit  is  set  in 
one  of  two  interrupt  pending  registers.    Interrupts  are  processed  after  the 
instruction  that  is  currently  executing  is  completed  (instructions  are 
indivisible).    If  the  interrupt  signal  does  not  occur  prior  to  four  state  times 
before  the  end  of  the  instruction,  the  interrupt  will  not  be  processed  until 
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after  the  following  instruction.    The  maximum  interrupt  latency,  based  on 
the  longest  instruction,  is  61  state  times.    When  the  interrupt  vector  is 
taken,  the  appropriate  bit  is  cleared  in  the  interrupt  pending  register. 
5.       FERRO  Hardware 

The  basic  design  for  the  FERRO  experiment  hardware  is  presented 
in  Reference  8.    Several  changes  have  been  made  to  the  initial  design  and 
the  updated  schematic  diagram  is  included  as  Appendix  A.    The  major 
components  of  FERRO  include  the  80C196KB  microcontroller,  a 
Programmable  Peripheral  Interface,  static  Random  Access  Memory  (RAM), 
Read  Only  Memory  (ROM),  temperature  sensors,  analog  drivers,  analog 
switches  and  multiplexers,  and  the  ferroelectric  capacitors  (DUTs).    Figure 
12  is  a  block  diagram  that  shows  the  relationship  between  the  major 
components. 
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Figure  12.   FERRO  Experiment  Block  Diagram 
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a.  Memory 

The  microcontroller  memory  consists  of  32  Kbytes  of  ROM 
and  8  Kbytes  of  static  RAM.    The  ROM  is  used  for  program  storage,  while 
the  RAM  is  used  as  a  scratchpad  and  for  temporary  storage  of  status  and 
experimental  data.    The  ROM  is  mapped  to  the  lower  half  of  the  memory 
space.    A  radiation-tolerant  32-Kbyte  ROM  chip  was  chosen  for  the 
experiment.    The  system  RAM  consists  of  a  radiation  hard  silicon-on- 
sapphire  8-Kbyte  static  RAM  chip.   The  chip  select  logic  was  modified  from 
the  original  design  to  provide  for  more  flexibility  in  adding  memory  devices. 
Up  to  four  8  Kbyte  memory  devices  are  allowed  for  above  program  memory. 

b.  Communication 

The  FERRO  experiment  will  communicate  with  the  APEX 
spacecraft  processor  using  the  80C196KB  serial  port.    A  packet  switching 
protocol  will  be  used  for  APEX  to  send  commands  to  FERRO  and  for  FERRO 
to  send  status  and  experiment  data  to  the  spacecraft  processor.    The  EIA 
RS-422  two-way  differential  hardware  interface  is  used  with  no  hardware 
handshake  lines  implemented. 

c.  Programmable  Peripheral  Interface 

The  Programmable  Peripheral  Interface  (PPI)  is  used  to 
extend  the  number  of  output  pins  available  to  control  the  analog  switching 
and  multiplexing  circuitry.    A  radiation-hard  version  of  the  82C55A  is  used 
which  provides  three  8-bit  ports.    The  original  design  called  for  the  input  to 
the  PPI  to  be  provided  from  Port  1  on  the  80C196KB.    This  would  have 
required  interface  control  signals  to  be  generated  by  the  microcontroller 
under  software  control.    A  memory-mapped  interface  to  the  PPI  was  chosen 
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instead.    The  memory-mapped  interface  requires  memory  decode  logic  to 
generate  the  chip  select,  but  has  no  software  overhead. 
d.       Ferroelectric  Capacitor  Input  Circuit 

The  PWM  and  HSO  circuits  on  the  microcontroller  generate 
pulses  to  fatigue,  read,  and  write  the  ferroelectric  capacitors.    A  block 
diagram  illustrating  the  select  circuitry  for  one  of  the  four  DUTs  is  shown 
below  in  Figure  13.    Analog  drivers  provide  isolation  and  provide  for  both 
positive  and  negative  pulses.    The  PWM  generates  a  continuous  train  of 
pulses  for  fatiguing.    Switches  are  provided  to  either  apply  the  fatigue 
pulses  to  the  ferroelectric  capacitors  or  to  ground  the  input  of  the 
capacitors.    Read  and  write  pulses  are  generated  by  the  HSO.    Analog 
switches  select  the  output  of  either  noninverting  or  inverting  amplifiers  to 
apply  positive  or  negative  pulses.    Fatigue  pulses  are  applied  to  DUTs  1  and 
2  only,  while  read  and  write  pulses  are  applied  to  all  four  DUTs. 


CVCli 
OUT 


Ffmo 

CAW 


_n- 


JU 


i 


GROUND 
OUT 


i 


z}\ 


Figure  13.   Ferroelectric  Capacitor  Input  Select  Circuit 
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e.       Ferroelectric  Capacitor  Output  Circuit 

The  analog  voltage  output  from  the  individual  Sawyer-Tower 
circuits  associated  with  each  ferroelectric  capacitor  is  applied  through  a 
series  of  analog  multiplexers  to  the  analog-to-digital  converter  on  the 
80C196KB.    Figure  14  below  shows  a  block  diagram  of  the  output  circuit 
for  a  typical  DUT. 
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Figure  14.  Ferroelectric  Capacitor  Read  Circuit 

When  enabled  during  a  read  operation,  the  Sawyer-Tower 
Select  switches  will  remove  the  ground  from  the  bottom  of  the  ferroelectric 
capacitors  and  switch  in  the  sense  capacitors.    When  not  enabled,  the 
switches  ground  the  bottom  of  the  ferroelectric  capacitors.    In  addition,  the 
sense  capacitors  are  removed  from  the  circuit  and  discharged.  The  eight 
Sawyer-Tower  circuits  for  each  DUT  are  operated  as  a  unit. 
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The  outputs  of  the  Sawyer-Tower  circuits  are  applied  to 
eight  4:1  analog  multiplexers  that  select  output  signals  from  the  proper 
DUT.    An  8:1  analog  multiplexer  then  selects  the  desired  channel  from  the 
eight  available  inputs.    It  should  be  noted  that  only  one  channel  of  the 
analog-to-digital  converter  is  needed  to  measure  any  of  the  32  ferroelectric 
capacitors. 

The  analog-to-digital  converter  on  the  80C196KB  can 
convert  only  positive  input  voltages.    Since  the  output  from  the  selected 
Sawyer-Tower  circuit  will  be  negative  for  negative  read  pulses,  an  inverting 
operational  amplifier  is  switched  in  for  these  conversions.    A  noninverting 
buffer  amplifier  is  selected  for  positive  voltages. 
/.        Temperature  Sensors 

Four  temperature  sensing  circuits  are  provided  to  monitor  the 
ambient  temperature  of  the  DUTs  during  the  experiment.    Two  thermistors 
are  mounted  adjacent  to  the  external  DUTs  and  two  are  mounted  adjacent 
to  the  internal  DUTs.    Changes  in  the  thermistor's  resistance  are  sensed  by 
an  operational  amplifier  circuit  that  produces  an  output  voltage  proportional 
to  the  temperature  of  the  thermistor.   The  circuits  sense  temperatures  over 
a  range  of  -40°C  to  +70°C  with  an  accuracy  of  ±1°C.    The  output  of  the 
sensing  circuit  is  applied  through  a  buffer  amplifier  to  the  analog-to-digital 
converter  on  the  80C196KB.    Each  of  the  four  sensing  circuits  have  a 
dedicated  channel  on  the  analog-to-digital  converter. 
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II.        SOFTWARE  REQUIREMENTS 

A.      DESIGN  GOALS 

The  Intel  80C196KB  microcontroller  will  perform  all  aspects  of 
experiment  control,  data  acquisition,  and  communication  with  the  host 
satellite  processor.   The  design  of  the  FERRO  system  and  experiment 
software  should  not  only  meet  the  specifications  of  the  experiment;  it 
should  maximize  the  probability  of  the  successful  conduct  of  the  experiment 
given  the  hardware  design.    To  meet  this  overall  objective,  the  following 
design  goals  for  the  FERRO  software  have  been  established  in  order  of 
precedence:    reliability,  ease  of  maintenance,  flexibility,  small  size,  and 
speed. 

1.       Reliability 

Since  the  experiment  will  be  conducted  in  space,  reliability  of  the 
software  is  of  primary  importance.    It  should  be  thoroughly  tested  and  error- 
free  before  the  experiment  is  delivered  for  spacecraft  integration.    Critical 
regions  where  interrupts  could  result  in  nondeterministic  program  behavior 
should  be  identified  and  accounted  for.    A  conservative  approach  should  be 
taken  with  respect  to  hardware  timing  constraints  wherever  possible. 

In  addition  to  the  reliability  of  the  software  itself,  the  reliability  of 
the  hardware  components  should  be  considered  in  the  software  design. 
Since  the  APEX  spacecraft  will  be  in  a  high-radiation  orbit,  the  possibility  of 
single-event-upsets  (SEU)  and  hard  faults  must  be  considered  and  allowed 
for  within  the  constraints  of  the  selected  hardware.    The  design  of  the 
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software  should  provide  for  fault  detection  and  recovery  and  should  allow 
for  redundancy  where  possible.    Cost  and  availability  have  limited  the  use  of 
radiation-hard  components,  so  the  radiation-hard  components  that  were 
chosen  should  be  used  for  permanent  storage  or  backup  of  data. 

2.  Ease  of  Maintenance 

Both  during  the  development  cycle  and  after  completion,  it  is 
important  that  the  software  be  easy  to  maintain.    The  software  design 
should  allow  for  changes  to  be  integrated  efficiently  and  without  introducing 
error.    The  software  should  be  easily  understood  by  follow-on  programmers 
and  engineers. 

To  meet  this  goal,  the  design  of  the  software  should  be  kept 
simple  and  straightforward.    Modular  design  and  structured  programming 
concepts  should  be  used  extensively.    A  high-level  language  should  be  used 
wherever  possible.    Documentation  of  the  program  should  be  thorough, 
clear,  and  concise.    Constants  and  variables  with  descriptive  names  should 
be  used  to  make  the  code  easier  to  read  and  understand.    Future  expansion 
and  changes  in  specifications  and  hardware  should  be  anticipated  and 
allowed  for  in  the  design  where  practical. 

3.  Flexibility 

The  software  should  give  the  ground  crew  as  much  flexibility  as 
possible  in  controlling  the  experiment.   The  more  options  available  to  the 
ground  crew,  the  more  likely  they  will  be  able  to  adjust  to  the  demands  of 
unforeseen  events  and  changes  that  may  occur  during  the  conduct  of  the 
experiment.    The  extent  of  the  flexibility  provided  may  ultimately  be  limited 
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by  the  hardware  design,  but  this  concept  should  be  kept  in  mind  throughout 
the  design  of  the  software. 
4.       Size  and  Speed 

Size  and  speed  are  not  overriding  considerations  in  the  software 
design  for  this  experiment,  but  these  attributes  will  be  optimized  when  doing 
so  does  not  compromise  the  other  design  goals.    While  this  may  not  provide 
direct  advantages,  keeping  the  code  small  and  fast  may  give  rise  to  side 
benefits  such  as  allowing  for  redundant  code  or  a  more  flexible  command 
structure. 

B.      INITIALIZATION  AND  RECOVERY 

The  FERRO  software  is  responsible  for  initializing  and  configuring  the 
80C196KB  microcontroller  and  the  onboard  peripherals  when  the  experiment 
is  powered  on.    Externally,  the  8255  Programmable  Peripheral  Interface 
must  be  initialized  and  the  analog  switches  and  multiplexers  must  be  set  to 
apply  ground  to  the  ferroelectric  capacitors.    Once  initialized  the  program 
will  stand  by  for  commands  from  the  spacecraft  processor  to  start  the 
experiment. 

Since  the  FERRO  experiment  is  considered  a  noncritical  load  on  the 
APEX  spacecraft,  it  is  possible  that  the  experiment  may  be  shut  down  for 
periods  to  conserve  power.    In  this  event,  orderly  shutdown  and  recovery 
procedures  must  be  provided  to  allow  the  experiment  to  continue  when 
power  can  be  restored.    Experiment  state  information  and  any  data  that  has 
been  collected  should  be  sent  to  the  spacecraft  processor. 
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In  the  event  of  an  unforeseen  loss  of  power  or  in  the  case  of  a  soft 
fault  causing  the  watchdog  timer  to  time  out,  the  software  should  recover 
gracefully  and  wait  for  further  commands. 

C.      COMMUNICATION 

The  FERRO  experiment  will  communicate  with  the  APEX  spacecraft 
processor  using  the  OX. 25  packet-switching  protocol.  The  data  will  be 
transmitted  as  asynchronous  bytes  at  a  data  rate  of  9600  bits  per  second 
with  one  start  bit,  one  stop  bit,  eight  data  bits  and  no  parity.    OX. 25  is 
based  on  the  Motorola  X.25  protocol  and  is  fully  described  in  Reference  10. 
Figure  15.  below  shows  the  packet  structure. 


FLAG 

SIZE 

DESTINATION        SOURCE 

CONTROL 

DATA 

CHECKSUM 

Figure  15.   FERRO  Packet  Structure 

The  flag  is  a  single  byte,  07EH,  that  signifies  the  start  of  the  packet.    If 
a  flag  character  occurs  as  data  within  the  packet,  an  extra  flag  character 
will  be  inserted  into  the  data  stream  as  the  packet  is  transmitted  to  serve  as 
an  escape  sequence.   When  the  packet  is  received,  the  extra  flag  character 
must  be  removed.    Any  single  flag  received  in  the  packet  following  the  first 
byte  is  an  error  and  the  packet  must  be  ignored. 
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Multi-byte  integers  can  be  stored  by  computer  systems  in  two  ways. 
The  values  may  be  stored  with  the  most  significant  byte  (MSB)  first  (at  a 
lower  address)  with  the  remaining  bytes  following  in  order  of  significance. 
This  is  referred  to  as  big  endian  format.    Another  format,  called  little  endian, 
stores  the  bytes  in  reverse  order  with  the  least  significant  byte  first.    In  both 
cases  the  address  of  the  first  byte  is  used  to  refer  to  the  value. 

Microprocessors  normally  use  one  of  these  formats.    Values  must  be 
stored  in  the  specified  format  to  be  operated  on  correctly  by  the  processor. 
Values  can  be  converted  between  the  two  formats  by  simply  reversing  the 
order  of  the  bytes. 

The  two-byte  size  field  specifies  the  length  of  the  data  field.    The  field 
is  stored  using  big  endian  format.    The  source  and  destination  fields  are 
two-byte  codes  specifying  the  source  and  destination  addresses  of  the 
packet.    If  FERRO  receives  a  packet  with  an  address  that  does  not  match 
the  FERRO  address,  the  packet  must  be  ignored.    All  packets  sent  by  FERRO 
will  have  the  APEX  spacecraft  address  specified  in  the  destination  field. 

Only  two  bits  of  the  two-byte  control  field  are  implemented  for  this 
experiment.    The  ACK  request  bit  (bit  3)  is  set  to  request  an 
acknowledgment  packet  in  response  to  the  command.  The  ACK  response  bit 
(bit  2)  is  set  in  the  packet  sent  in  response.    All  commands  sent  by  the 
spacecraft  processor  will  have  the  ACK  request  bit  set  and  thus  will  require 
a  response. 

The  two-byte  checksum  field  is  used  to  detect  errors  that  could  occur 
during  transmission.    The  checksum  encoding  and  decoding  algorithm  is 
specified  in  Reference  10  and  is  presented  below. 
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Assume: 


Len  is  the  length  of  the  packet. 

P  is  an  array  of  length  Len  with  elements  numbered  from  O..Len-1 . 

CO  and  C1  are  one-byte  checksum  accumulators. 


Encoding  Algorithm: 

Initialize: 

P[Len-1]  =  P[Len-2]  =  0; 

CO  =  C1   =  0; 
Compute: 

for  i  :  =  0  to  Len  -1  do 
CO  :  =  CO  +  P[i]; 
C1  :=  CO  +  C1; 
Store  results: 

P[Len-2]  :=  CO-  C1; 

P[Len-1]  :=  C1  -  2xC0 


Decoding  Algorithm: 

Compute: 

for  i  :  =  0  to  Len  -1  do 
CO  :=  CO  +  P[i]; 
C1  :=  CO  +  CI; 
Result: 

Checksum  is  valid  if  both 
CO  and  C1  are  zero. 


If  an  invalid  checksum  is  received,  the  packet  will  be  ignored. 

The  spacecraft  processor  will  initiate  all  communication  in  the  form  of 
commands  to  the  FERRO  processor.    Commands  will  all  have  a  four-byte 
data  field  with  the  first  byte  containing  a  code  specifying  the  command. 
The  remaining  three  bytes  can  contain  supplementary  data  with  any  unused 
bytes  set  to  zero.  FERRO  will  respond  either  with  a  packet  containing  the 
requested  data  or  with  an  acknowledgment  packet. 

If  the  spacecraft  processor  does  not  receive  a  valid  packet  in  response 
to  a  command,  the  command  will  be  reissued.    Transmission  of  the 
response  packet  must  be  completed  within  two  seconds  after  FERRO 
receives  the  command  or  the  spacecraft  processor  will  assume  the 
command  will  not  be  acknowledged. 
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D.  ERROR  DETECTION 

The  FERRO  experiment  will  be  required  to  operate  in  a  harsh 
environment  over  a  long  period.    Use  of  the  watchdog  timer  for  detecting 
catastrophic  errors  will  prevent  the  microcontroller  from  being  locked  in  an 
infinite  loop.    In  addition,  methods  for  detecting  more  subtle  errors  are 
necessary  to  ensure  the  integrity  of  the  data  gathered.    Both  the  program 
firmware  and  the  experiment  data  buffers  should  be  checked  for  errors 
periodically.    In  the  case  of  a  soft  fault,  recovery  can  be  initiated  and  the 
experiment  can  continue.    In  the  case  of  a  hard  fault,  recovery  may  not  be 
possible. 

E.  EXPERIMENT  CONTROL 

The  experiment  will  be  conducted  under  software  control  as  modified 
by  commands  issued  either  from  the  ground  or  automatically  by  the 
spacecraft  processor.   The  software  will  initiate  and  control  the  fatigue  and 
ageing  cycles  of  the  experiment  as  defined  in  Table  1  and  Figure  6. 
Ferroelectric  capacitor,  temperature  and  status  data  will  be  collected  at 
appropriate  times  and  sent  to  the  spacecraft  processor  when  commanded. 
The  spacecraft  processor  will  temporarily  store  the  data  and  periodically 
downlink  the  data  from  all  three  experiments  to  the  ground  station. 

A  real-time  experiment  clock  will  be  maintained  to  act  as  a  reference 
for  experiment  events  and  to  time-tag  data.   The  experiment  clock  will  be 
referenced  to  the  spacecraft  universal  time  and  will  be  synchronized  to 
universal  time  periodically. 
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F.       TEST/VERIFICATION 

A  system  to  simulate  the  spacecraft  processor  will  be  required  for 
testing  during  software  development  and  for  verifying  the  functional 
operation  of  the  experiment  at  delivery.   The  system  must  be  able  to 
transmit  all  commands  that  can  be  issued  by  the  spacecraft.    It  must  also 
receive  the  responses  from  the  experiment  hardware.    The  responses  will  be 
displayed  and  evaluated  for  accuracy.    The  system  should  allow  a 
permanent  log  of  the  testing  to  be  saved  for  later  analysis. 
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HI.       SOFTWARE  IMPLEMENTATION 

The  Intel  iC-96  C  compiler  was  chosen  for  development  of  the  FERRO 
software.    The  compiler  provides  for  easy  and  direct  manipulation  of  the 
microcontroller's  SFRs  while  maintaining  the  advantages  of  a  high  level 
language.    A  number  of  pragmas,  or  directives  to  the  compiler,  are  available 
to  give  the  programmer  precise  control  over  the  resources  offered  by  the 
80C196KB  microcontroller.    The  compiler  also  supports  in-line  assembly 
language  for  use  where  speed  is  essential.    Reference  11  gives  a  complete 
description  of  the  compiler  and  relocatable  linker. 

An  IBM  PC  based  development  system  with  an  80C196  emulator  was 
used  for  testing  and  debugging  during  software  development.    The  emulator 
is  discussed  in  Reference  12.    A  pod  that  plugged  into  the  processor  socket 
on  the  experiment  prototype  board  allowed  the  emulator  to  interface  with 
peripherals  as  they  were  added  to  the  board.    The  system  provides  for 
emulation  of  both  ROM  and  RAM.    Features  of  the  system  include  software 
breakpoints,  single  and  multiple  step  operation,  and  easy  access  to  SFRs 
and  memory. 

Almost  all  variables  are  stored  in  RAM  in  order  to  take  advantage  of 
the  radiation-hard  component  used.    Only  variables  used  in  operations 
where  time  is  a  consideration  are  stored  in  registers.    A  compiler  pragma  is 
used  to  disable  the  storage  of  variables  in  registers  except  when  explicitly 
declared.    The  source  code  for  the  FERRO  experiment  is  included  as 
Appendix  B.   The  source  was  divided  into  several  files  by  functional  area  for 
organizational  purposes  and  to  allow  for  changes  to  the  code  to  be  made 
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without  recompiling  the  entire  program.    A  make  utility  was  used  to  aid  in 
the  compiling  and  linking  of  the  source  files. 

A.      INITIALIZATION  AND  RECOVERY 

Initialization  routines  for  the  microcontroller  and  programmable 
peripheral  interface  are  called  immediately  after  the  experiment  is  powered 
up.    The  8255  is  set  to  provide  three  8-bit  output  ports  for  analog  switching 
and  multiplexer  control.    Initial  values  are  sent  to  the  ports  to  ground  the 
ferroelectric  capacitors. 

A  compiler  pragma  statement  sets  the  Chip  Configuration  Byte  (CCB). 
The  CCB  is  loaded  into  the  Chip  Configuration  Register  whenever  the 
80C196KB  is  reset  and  on  power  up.    For  FERRO,  the  CCB  is  set  for  an  8- 
bit  bus  width  and  to  use  the  Address  Valid  Strobe  bus  control  signals. 
These  settings  were  chosen  to  be  compatible  with  peripherals  used. 

The  serial  port  is  initialized  to  provide  asynchronous  communications  at 
9600  bits  per  second.    The  baud  rate  is  based  on  the  system  clock  of 
4.9152  MHz.    The  value  for  the  baud  register  can  be  calculated  from  the 
formula  shown  in  equation  (3). 


System  Clock 
sr  =  z      .  ~ —  -  1 


Baud  Register 

a  Baud  Rate  x  16 


The  most  significant  bit  of  the  16-bit  baud  register  must  be  set  to 
select  the  system  clock  as  the  reference.    Substituting  values  into  equation 
(3)  and  setting  the  MSB  yields  a  value  of  801 FH.    The  value  must  be  loaded 
into  the  baud  register  as  two  sequential  bytes,  with  the  low  byte  loaded 
first.    This  method  is  obscurely  described  in  one  sentence  of  Reference  9 


37 


and  was  discovered  only  after  several  hours  of  frustration.    Once  the  serial 
port  is  initialized,  the  receive  (Rl)  interrupt  is  unmasked  and  interrupts  are 
enabled. 

The  HSO  Software  Timer  0  is  set  to  initiate  an  interrupt  every  0.125 
seconds.    The  interrupts  are  used  to  update  the  real-time  clock  for  the 
experiment.    Timer  2  is  the  reference  for  the  HSO  commands  that  implement 
the  real-time  clock  and  an  HSO  command  is  used  to  reset  the  timer  each 
time  the  interrupt  is  generated.   These  commands  are  all  locked  in  the  HSO 
CAM  to  produce  the  desired  periodic  interrupts  without  further  processor 
overhead. 

The  Timer  2  Clock  input  is  derived  from  the  CLKOUT  pin  of  the 
80C196KB.    The  CLKOUT  pin  supplies  a  50%  duty  cycle  clock  signal  at 
one-half  the  system  clock  frequency.    This  signal  is  applied  to  a  4-bit 
counter  (see  Appendix  A)  that  is  used  to  divide  the  frequency  by  16.    The 
resulting  frequency  provides  one  transition  every  eight  state  times  which  is 
the  maximum  clock  frequency  that  should  be  used  as  a  reference  for  the 
HSO. 

Once  initialization  is  complete,  a  wait  loop  is  executed  until  the  first 
command  is  received  from  the  spacecraft.   The  watchdog  timer  is  enabled 
and  is  reset  each  time  the  wait  loop  is  executed. 

B.      COMMUNICATION 

Packets  carrying  commands  from  the  spacecraft  processor  will  be 
processed  by  an  interrupt  driven  routine.    A  flow  diagram  describing  the 
algorithm  to  receive  and  validate  the  packet  is  shown  in  Figure  16. 
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Figure  16.   Receive  Interrupt  Flow  Diagram 
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When  the  serial  port  receives  a  byte,  the  Rl  interrupt  flag  is  set  and 
control  is  transferred  to  the  receive  interrupt  service  routine.    For  all 
interrupt  routines,  the  compiler  generates  code  that  disables  interrupts  and 
pushes  the  PSW  and  interrupt  mask  registers  on  the  stack.    The  interrupts 
are  globally  disabled  and  the  interrupt  mask  registers  are  cleared.    The 
programmer  must  explicitly  re-enable  interrupts  if  they  are  to  be  serviced 
during  the  interrupt  routine.    Interrupts  are  enabled  upon  exiting  the 
interrupt  routine  when  the  PSW  and  mask  registers  are  restored. 

The  only  interrupt,  besides  the  receive  interrupt,  that  the  FERRO 
software  uses  is  the  software  timer  that  updates  the  real-time  clock.    A 
decision  was  made  not  to  enable  interrupts  during  the  receive  interrupt 
processing  due  to  the  short  time  (approximately  0.2  msec  average,  1  msec 
worst  case)  spent  in  the  receive  interrupt  routine. 

Each  call  of  the  interrupt  handler  will  process  one  byte  of  the  packet. 
The  serial  port  status  register  is  checked  each  time  for  stop  bit  and  overrun 
errors.    The  packet  is  immediately  discarded  if  any  error  is  indicated.    Once 
the  packet  is  discarded,  the  spacecraft  processor  must  retransmit  the  entire 
packet.    If  no  error  is  detected,  the  byte  is  retrieved  from  the  serial  buffer 
for  further  processing. 

The  packet  is  assembled  in  a  memory  buffer  as  the  individual  bytes  are 
received.    An  index  is  used  to  point  to  the  next  buffer  location  to  be  used. 
The  index  also  indicates  the  position  within  the  packet  of  the  byte  being 
processed. 

When  the  index  is  zero,  indicating  the  start  of  the  packet,  the  routine 
ignores  any  character  other  than  a  flag  character.    Once  the  flag  is  received, 
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it  is  stored  in  the  buffer  and  the  index  is  incremented.    Flag  characters 
occurring  after  the  first  byte  must  be  processed  to  determine  if  they  are  part 
of  a  valid  escape  sequence.   The  escape  sequence  consists  of  two 
consecutive  flag  characters  and  is  used  to  indicate  the  occurrence  of  a  flag 
character  within  the  body  of  a  packet. 

A  boolean  variable,  State,  is  used  to  detect  the  occurrence  of  an 
escape  sequence.    State  is  initialized  to  false.    When  a  flag  character  is 
received  in  the  body  of  a  packet,  State  is  set  to  true  and  the  routine  ends, 
awaiting  the  reception  of  the  next  byte.    If  the  next  byte  is  a  flag,  State  is 
again  inverted;  a  valid  escape  sequence  has  been  detected  and  a  single  flag 
character  is  entered  into  the  buffer. 

Receiving  a  character  other  than  a  flag  when  State  is  true  indicates 
that  a  single  flag  has  been  encountered.  When  this  occurs,  it  is  assumed 
that  the  flag  marks  the  start  of  a  new  packet.    Any  previously  received  data 
is  discarded  with  the  exception  of  the  last  two  bytes:  the  flag  and  the  byte 
that  was  just  received.    Since  the  byte  just  received  is  the  second  byte  of 
the  new  packet,  the  index  is  set  to  point  to  the  second  location  of  the 
packet  buffer  and  the  byte  is  stored. 

When  the  second  and  third  bytes  of  the  packet  have  been  received, 
the  length  of  the  packet  can  be  calculated.    As  mentioned  previously,  the 
size  field  is  stored  in  big  endian  format  and  thus  must  be  converted  to  little 
endian  format  to  be  used  by  the  80C196KB  processor.    The  overhead 
length,  consisting  of  the  sum  of  the  header  and  checksum  lengths,  is  added 
to  the  converted  data  field  length  to  yield  the  total  length  of  the  packet. 
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This  value  is  used  to  detect  when  the  last  byte  of  the  packet  has  been 
received.    Once  the  entire  packet  has  been  received,  the  destination  field  is 
checked  to  ensure  that  it  matches  FERRO's  address  and  the  checksum  is 
validated.   The  packet  is  discarded  if  either  check  fails.    If  the  packet  is 
valid,  the  command  byte  (i.e.,  the  first  byte  of  the  data  field)  is  placed  in  the 
command  list  to  be  processed.    The  command  list  is  a  circular  queue  with 
space  for  up  to  three  pending  commands. 

Acknowledgment  and  data  packets  are  transmitted  to  the  spacecraft 
processor  using  a  simple  busy-wait  loop  that  waits  for  the  transmit-buffer- 
empty  bit  to  be  set  in  the  serial  port  status  register.    If  a  flag  character 
occurs  within  the  body  of  the  packet,  a  second  flag  is  inserted  in  the  data 
stream  to  indicate  an  escape  sequence.    The  double-buffering  feature  of  the 
serial  port  transmitter  is  used  to  transmit  the  second  flag.    The  watchdog 
timer  is  reset  after  each  byte  is  transmitted  to  ensure  the  timer  does  not 
overflow  when  long  packets  are  transmitted. 

C.      ERROR  DETECTION 

The  watchdog  timer  can  detect  catastrophic  errors  that  cause  a 
deviation  from  the  normal  program  flow.    During  normal  program  operation, 
the  software  will  reset  the  watchdog  timer  at  intervals  that  will  prevent  the 
timer  from  overflowing.    Any  error  that  affects  the  program  flow  in  a 
manner  that  prevents  the  reset  from  occurring  within  the  normal  timeframe 
will  result  in  a  reset  of  the  80C196KB  microcontroller. 

After  the  processor  is  reset,  the  initialization  phase  will  be  conducted 
and  the  experiment  will  have  to  be  restarted  by  a  command  from  the  ground 
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crew.    If  the  error  is  not  permanent  in  nature  (i.e.,  due  to  an  single-event- 
upset),  the  experiment  can  carry  on  with  only  a  minor  loss  of  data.    A 
permanent  fault  may  result  in  the  same  watchdog  failure  thereby  precluding 
the  continuation  of  the  experiment. 

Errors  that  occur  during  communication  are  detected  with  the  two-byte 
checksum  as  specified  in  the  OX. 25  protocol.   The  checksum  routines  can 
also  be  used  to  detect  errors  that  may  occur  during  data  collection.    This 
feature  was  not  ready  in  time  to  be  integrated  into  the  software  for  the 
experiment,  but  the  method  will  be  described  here. 

A  checksum  of  the  data  buffer  is  calculated  and  stored  each  time  data 
is  collected.    Just  prior  to  the  next  data  collection  event  the  checksum 
validation  routine  is  called  to  ensure  that  the  data  in  the  buffer  remains 
unchanged.    If  an  error  is  detected,  a  flag  is  set  and  a  time  tag  stored  so 
that  the  data  in  question  can  be  identified.    Another  option  would  have  been 
to  discard  the  questionable  data  by  clearing  the  buffer,  but  keeping  the  data 
and  allowing  the  decision  to  be  made  on  the  ground  provides  for  more 
flexibility. 

D.      EXPERIMENT  CONTROL 

Once  FERRO  has  started,  the  experiment  will  be  conducted  according 
to  a  preset  schedule.    Scheduled  events  will  be  initiated  by  the  experiment 
control  routines  at  specified  times.    FERRO's  real-time  clock  will  be  the 
reference  for  all  scheduled  events. 

Overall  control  of  the  experiment  will  be  accomplished  by  commands 
issued  either  by  personnel  on  the  ground  or  automatically  by  the  spacecraft 
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processor.    These  commands  will  control  the  initiation  and  shutdown  of  the 
experiment,  the  downloading  of  experiment  and  status  data  from  FERRO  to 
the  spacecraft  processor,  and  will  allow  for  limited  testing  of  the  FERRO 
hardware  and  software  without  signals  being  applied  to  the  ferroelectric 
capacitors.    Table  3  shows  the  FERRO  commands. 

TABLE  3.   FERRO  COMMANDS  [Ref.  1] 


Command 

Byte  1 

Byte  2 

Byte  3 

Byte  4 

Source 

Data  Dump 

010H 

* 

* 

+ 

Spacecraft 

End  Test  Mode 

020H 

+ 

* 

* 

Ground 

Initialize 

030H 

* 

* 

* 

Ground 

Restart 

040H 

Cycle 

Cycle  Day 

* 

Ground 

Shutdown 

050H 

* 

» 

* 

Ground 

SOH 

070H 

* 

• 

* 

Spacecraft 

Test  Mode 

090H 

* 

* 

* 

Ground 

UTime 

OAOH 

♦ 

* 

* 

Ground/ 
Spacecraft 

1st  Parameter 

OFOH 

MSB 
Time  Tag 

2nd  Byte 
Time  Tag 

* 

Ground/ 
Spacecraft 

2nd  Parameter 

OFOH 

3rd  Byte 
Time  Tag 

LSB 
Time  Tag 

* 

Ground/ 
Spacecraft 

*  Indicates  that  FERRO  will  ignore  these  bytes. 

1.       FERRO  Commands 

The  Initialize  command  is  used  to  start  the  experiment  and  should 
be  issued  only  once  during  the  conduct  of  the  experiment.    An  acknowledge 
packet  is  sent  to  the  spacecraft  processor  and  the  command  is  removed 
from  the  command  list.    The  Cycle  and  Cycleday  variables  are  initialized  to 
one  and  zero  respectively.    Cycle  counts  the  number  of  21 -day  experiment 
cycles  conducted;  Cycleday  indicates  the  day  within  the  cycle.    Setting 
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Cycle  to  zero  allows  the  first  day  of  the  cycle  to  begin  at  midnight  of  the 
day  the  Initialize  command  is  sent. 

The  Initialize  command  must  be  followed  immediately  by  a  Utime 
command  to  set  the  real-time  clock.    Utime  is  really  a  sequence  of  three 
packets:    the  first  specifies  the  Utime  command,  while  two  parameter 
packets  are  used  to  carry  the  time  from  the  spacecraft.    The  time-tag  value 
is  defined  as  the  number  of  seconds  since  January  1,  1980.    The  32-bit 
value  is  sent  in  big  endian  format  and  thus  must  be  converted.    Only  the 
number  of  seconds  elapsed  during  the  current  day  is  needed  by  the 
experiment,  so  the  excess  is  stripped  using  the  modulus  operation.    The 
resulting  value  is  used  to  set  the  real-time  clock. 

The  real-time  clock  is  implemented  as  a  double-word  (32-bit) 
variable  that  is  incremented  each  second.   The  clock  value  indicates  the 
number  of  seconds  that  have  elapsed  for  the  current  day.    Software  Timer  0 
is  used  to  update  the  clock.    Since  the  interrupt  for  this  timer  occurs  at 
0.125  second  intervals,  a  bit  is  shifted  through  a  register  to  count  eight 
interrupts  before  incrementing  the  clock.    The  clock  is  reset  to  zero  each 
day  at  midnight.    Cycle  and  Cycleday  are  also  updated  at  that  time. 

The  Utime  command  is  the  only  method  to  set  the  real-time  clock. 
The  command  will  be  sent  immediately  following  the  Initiate  and  Restart 
commands  to  set  the  clock  initially.    In  addition,  the  spacecraft  processor 
will  send  the  Utime  command  once  every  twenty-four  hours  to  ensure  the 
experiment  clock  remains  synchronized  with  the  spacecraft  clock.    When 
the  clock  is  set,  a  critical  region  is  established  by  globally  disabling 
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interrupts  before  altering  the  value.   This  is  necessary  because  it  takes  more 
than  one  instruction  to  store  the  double-word  variable. 

The  Restart  command  is  similar  to  the  Initiate  command  except 
that  it  is  used  in  case  the  experiment  was  shut  down  or  the  processor  was 
reset.    The  second  and  third  bytes  of  the  data  field  in  the  Restart  packet 
contain  values  to  set  Cycle  and  Cycleday.    The  Restart  command  is  issued 
by  the  ground  crew  who  must  determine  where  in  the  experiment  cycle  to 
restart  the  experiment.    Again,  the  Utime  command  and  two  parameter 
packets  must  immediately  follow  to  set  the  real-time  clock. 

After  either  the  Initialize  or  Restart  command  has  been  executed, 
control  is  passed  to  an  experiment  executive  control  routine  that  manages 
the  conduct  of  the  experiment.    The  routine  consists  of  an  infinite  loop  that 
checks  if  a  command  packet  has  been  received  or  if  a  scheduled  experiment 
event  is  due  to  occur.    Additionally,  the  routine  initiates  collection  of 
temperature  data  every  32  seconds. 

The  Data  Dump  command  is  issued  by  the  spacecraft  processor 
once  each  day,  two  minutes  before  midnight.    FERRO  will  respond  by 
transmitting  a  packet  containing  the  ferroelectric  capacitor  data  collected 
during  the  day.    As  the  polarization  of  the  capacitors  is  measured  according 
to  the  experiment  schedule,  the  data  is  stored  in  a  designated  buffer  where 
the  data  dump  packet  is  assembled. 

Although  the  number  of  measurements  each  day  varies,  the 
length  of  the  packet  is  fixed.    Separate  sub-fields  for  fatigue  and  ageing 
data  are  allocated  within  the  data  field.   The  size  of  each  of  the  sub-fields  is 
determined  by  the  number  of  measurements  accomplished  during  the  first 
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day  of  an  ageing  cycle  for  either  the  fatigue  or  ageing  DUTs;  23  reads  of  the 
16  capacitors  requires  368  bytes.   The  cycle-number  and  cycle-day  are 
included  in  the  data  dump  packet  to  identify  the  data. 

The  State  of  Health  (SOH)  command  causes  FERRO  to  respond 
with  a  packet  containing  experiment  status  and  temperature  data.    The 
spacecraft  processor  will  issue  the  SOH  command  once  each  minute.    Data 
from  the  four  temperature  sensors  is  collected  every  32  seconds  and  is 
stored  the  SOH  packet  buffer. 

A  flag  in  the  SOH  packet  is  used  to  indicate  when  the  experiment 
is  in  test  mode.    When  the  SOH  command  is  received,  a  time  tag  is  obtained 
by  reading  the  value  of  the  real-time  clock.   The  value  is  converted  to  big 
endian  format  and  transmitted  with  the  packet.    More  significant  status 
reporting  was  planned,  but  was  not  implemented  in  time  to  be  tested. 

Commands  to  enter  and  exit  test  mode  allow  for  limited  testing  of 
the  FERRO  hardware  and  software.    While  in  test  mode,  all  commands  are 
received  and  acknowledged  as  they  would  be  during  normal  operation,  but 
signals  are  not  applied  to  the  DUTs.    This  capability  allows  both  FERRO  and 
the  interface  to  the  spacecraft  to  be  tested  without  affecting  the  capacitors. 

The  Shutdown  command  is  used  if  power  must  be  removed  from 
FERRO  after  the  experiment  has  started.    When  the  command  is  received, 
FERRO  responds  by  immediately  transmitting  an  SOH  packet  followed  by  a 
Data  Dump  packet.    After  sending  the  packets,  the  real-time  clock  is 
disabled  to  prevent  further  experiment  events  from  occurring  and  fatiguing 
of  the  ferroelectric  capacitors  is  stopped.    The  experiment  can  be  resumed 
after  power  is  restored  by  issuing  a  Restart  command. 
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2.       FERRO  Experiment  Events 

A  preset  schedule  of  events  is  used  to  carry  out  the  21 -day 
experiment  cycle  that  is  described  by  Figure  6  and  Table  1.    Scheduled 
events  include  the  initiation  of  a  fatigue  cycle,  writing  to  and  reading  from 
DUTs  for  ageing,  and  taking  measurements  from  DUTs  after  periods  of 
fatiguing.   These  events  are  scheduled  to  occur  during  the  appropriate  day 
of  the  experiment  cycle  at  a  time  relative  to  the  real-time  clock. 

When  the  real-time  clock  is  updated,  a  list  of  times  for  events  to 
occur  during  the  present  cycle-day  is  scanned  and  compared  to  the  clock 
value.    If  a  match  is  found,  the  event  code  is  placed  in  a  pending  list.    The 
experiment  executive  control  routine  will  then  cause  the  event  to  be 
executed. 

A  fatigue  cycle  must  be  initiated  at  the  beginning  of  each  21 -day 
experiment  cycle  and  must  be  reinitiated  following  ageing  of  the  fatigue 
DUTs.    Fatiguing  is  started  by  enabling  and  configuring  the  PWM  to  produce 
the  5  kHz  pulse  train  and  setting  the  analog  switches  to  route  the  signal  to 
the  appropriate  DUTs.    Fatiguing  is  stopped  by  disabling  the  PWM  and 
disconnecting  the  DUTs. 

Fatiguing  of  the  ferroelectric  capacitors  in  the  two  fatigue  DUTs 
will  be  stopped  briefly  each  day,  just  before  the  Data  Dump  command  is 
expected,  to  collect  data.    Two  data  points  will  be  collected  for  each  of  the 
sixteen  capacitors.    First,  a  positive  write  pulse  will  be  applied  to  the 
capacitors  followed  by  a  read  operation  using  a  negative  read  pulse.    The 
sequence  will  then  be  repeated  with  reversed  polarities. 
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The  HSO  unit  is  used  to  generate  the  read  and  write  pulses  and  to 
schedule  the  A/D  conversion  process  to  occur  during  the  read  pulse.    Both 
the  read  and  write  pulses  are  one  millisecond  in  duration.    The  pulse  length 
was  chosen  to  ensure  that  the  circuitry  in  the  path  to  the  A/D  converter  has 
ample  time  to  settle  before  the  line  is  sampled.    The  write  pulse  could  be 
shortened  considerably,  but  keeping  the  pulses  the  same  length  had  no 
impact  on  the  experiment  timing. 

For  reading  the  fatigue  capacitors,  the  A/D  conversion  is 
scheduled  to  start  120  state  times  before  the  end  of  the  read  pulse.    This 
ensures  that  the  conversion  process  will  be  complete  before  the  pulse  ends. 
The  A/D  conversion  is  scheduled  differently  for  the  ageing  read  process  and 
will  be  discussed  below.    After  all  of  the  capacitors  have  been  read,  the 
fatigue  process  is  resumed. 

At  the  start  of  an  ageing  cycle,  an  initial  write  to  the  DUTs  being 
aged  must  be  performed.    After  the  first  ageing  period,  the  capacitors  will 
be  read  and  the  read  operation  will  be  immediately  followed  by  a  write 
operation  to  store  the  value  for  the  next  ageing  period.    This  sequence  will 
be  repeated  until  the  ageing  cycle  is  complete. 

The  read  operation  for  ageing  must  be  different  from  the  one  used 
for  fatiguing  because  the  capacitors  in  each  DUT  are  connected  internally  on 
the  input  side.    This,  in  conjunction  with  the  design  of  the  switching  circuit, 
dictates  that  all  eight  capacitors  in  the  DUT  are  subjected  to  any  read  and 
write  pulses  applied  to  the  DUT.    This  does  not  impact  the  fatigue  data 
collection  since  a  write  operation  is  performed  immediately  before  each  read 
operation.    Each  capacitor  is  written  to  and  read  from  twice;  thus  32  pulses 
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are  applied  to  all  eight  capacitors  in  the  DUT  although  only  four  are 
pertinent  to  each  one.  These  few  extra  read  and  write  pulses  applied  to  the 
capacitors  are  insignificant  compared  to  the  number  of  fatigue  pulses 
applied. 

The  problem  with  using  a  separate  read  pulse  for  each  capacitor 
for  ageing  measurements  is  that  the  read  pulse  for  one  capacitor  will 
effectively  act  as  a  write  pulse  to  the  other  capacitors  in  the  DUT.    These 
capacitors  will  be  repolarized  in  the  direction  of  the  read  pulse  and  thus  the 
ageing  data  would  be  invalid  for  all  but  the  first  capacitor  read.    The 
polarization  measured  from  these  capacitors  would  be  the  result  of  the 
previous  capacitor's  read  pulse  rather  than  the  write  operation  performed  at 
the  beginning  of  the  ageing  period. 

The  solution  to  this  problem  is  to  apply  a  single  read  pulse  to  the 
DUT  and  conduct  all  eight  A/D  conversions  in  sequence  during  the  pulse. 
The  CAM  is  not  large  enough  to  schedule  all  eight  A/D  conversions,  so  only 
the  first  is  scheduled  and  a  busy-wait  loop  is  used  to  conduct  the  remaining 
seven  conversions  in  succession. 

E.      TEST/VERIFICATION 

An  IBM  PC  based  software  program  designed  to  simulate  the 
spacecraft  processor  was  used  for  testing  during  FERRO  hardware  and 
software  development  and  to  verify  the  functional  operation  of  FERRO  when 
the  experiment  was  delivered  for  integration  to  the  spacecraft  bus.    The 
program  uses  the  PC's  RS-232  serial  port  for  communication  with  FERRO 
via  RS-232  to  RS-422  level  shifters. 
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The  program  was  developed  using  the  C  compiler  included  with 
Borland  C++.    The  compiler  offers  access  to  the  operating  system  and  PC 
BIOS  calls  necessary  to  directly  control  the  serial  interface.    The  integrated 
development  environment  offers  a  program  editor,  project  manager,  and 
source-level  debugger.    A  windowing  and  menu  library  was  used  to  provide 
a  user-friendly  interface  for  the  program.    The  source  code  for  the  test  and 
verification  software  is  included  as  Appendix  C. 

Pull  down  menus  provide  selections  to  set  communication  parameters 
including  baud  rate,  number  of  data  bits,  parity,  and  number  of  stop  bits. 
These  parameters  can  be  saved  in  a  configuration  file  so  that  future 
sessions  will  default  to  the  chosen  setup.    Other  selections  initialize  or  reset 
the  serial  communication  port,  allow  recording  of  all  communications  in  a 
log  file,  and  send  command  packets  to  the  FERRO  experiment. 

All  FERRO  commands  can  be  sent  by  the  software  and  prompts  are 
provided  for  the  user  to  supply  data  for  the  Parameter  packets  when  setting 
the  real-time  clock.    The  outgoing  packet  is  displayed  in  one  window  and 
the  response  from  FERRO  is  displayed  in  another.    The  packet  is  parsed  and 
labeled  for  display  so  that  the  packet  header,  data  field,  and  checksum  can 
be  distinguished.    The  status  of  the  checksum  validation  is  displayed 
following  the  checksum  field. 

A  record  of  all  communication  between  FERRO  and  the  test/verification 
software  can  be  saved  in  a  log  file.    A  menu  selection  toggles  the  logging 
feature  on  or  off.    The  user  can  select  a  file  name  for  the  log  file  or  use  the 
default  file  name. 
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IV.       CONCLUSIONS  AND  RECOMMENDATIONS 

Several  goals  set  at  the  beginning  of  software  development  were  only 
partially  met.   The  most  significant  shortfall  was  in  the  area  of  error 
detection.    Additionally,  a  complete  test  of  the  FERRO  software  on  the 
experiment  hardware  was  not  completed  prior  to  delivery  of  the  experiment. 

When  software  development  for  FERRO  began,  the  specifications  for 
the  communication  interface  between  the  experiment  and  the  spacecraft 
processor  were  immature  in  several  areas  including  the  command  structure, 
universal  time  format,  and  use  of  the  control  field.    Software  development 
had  to  proceed  before  these  specifications  could  be  firmed  up  to  meet  the 
schedule  for  delivery  of  the  experiment. 

Additionally,  several  specifications  including  the  length  of  the  size, 
source,  and  destination  fields  were  changed  well  into  the  software 
development  cycle.    These  factors  resulted  in  extensive  changes  to  routines 
that  were  already  functional  and  tested.    A  significant  amount  of  time  was 
spent  making  these  changes  and  debugging  the  inevitable  errors  introduced 
by  the  changes.    As  a  result,  several  planned  features  were  not 
implemented  in  the  FERRO  software.    It  ultimately  became  more  important 
to  get  something  that  worked  out  the  door  rather  than  add  and  test 
additional  features. 

A  method  for  performing  checksum  validation  of  program  memory  and 
the  data  collection  buffers  periodically  would  ensure  that  SEUs  and  hard 
faults  caused  by  radiation  exposure  do  not  go  undetected.    This  error 
checking  in  conjunction  with  storing  multiple  copies  of  the  program  code  in 
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ROM  would  allow  the  experiment  to  suffer  multiple  faults  and  still  be  able  to 
complete  the  mission. 

The  checksum  validation  routine  used  for  communication  was  designed 
so  that  it  could  also  be  used  to  check  either  program  memory  or  the  data 
collection  buffers.    The  proposed  method  for  checking  the  data  buffers  was 
discussed  earlier.    To  implement  error  checking  for  the  program  code,  a 
checksum  for  a  specified  area  of  program  memory  would  have  to  be 
calculated  off  line  and  stored  in  ROM  at  the  end  of  the  program  code. 
Periodically,  the  checksum  validation  routine  would  be  called  to  validate  the 
program  memory. 

If  an  error  was  detected,  a  flag  would  be  set  and  a  system  reset 
conducted.    The  program  start-up  code  would  recognize  the  flag  (registers 
are  not  cleared  by  a  reset)  and  would  call  a  different  copy  of  the  experiment 
software.    There  would  be  areas  of  the  software  that  could  not  be 
duplicated  (i.e.,  the  start-up  code),  but  this  type  of  error  checking  and 
recovery  mechanism  could  significantly  increase  reliability  of  the  experiment 
software. 

Another  area  that  could  be  improved  is  the  command  interface.    The 
command  structure  evolved  through  the  many  specification  changes  and  the 
result  is  not  as  clean  and  efficient  as  originally  envisioned.    One  possible 
improvement  would  be  to  implement  the  command  decision  tree  with  a  state 
matrix.    Rather  than  ignoring  illegal  commands,  a  flag  could  be  set  in  the 
acknowledge  packet  so  that  the  that  the  spacecraft  processor  would  not 
simply  retransmit  the  command.    More  status  and  mode  information  should 
be  included  in  the  SOH  packet.    Additional  information  could  be  used  by 
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ground  personnel  to  take  appropriate  corrective  action  should  problems 
occur. 

Finally,  the  format  of  the  data  packet  could  be  improved  to  make  it 
easier  to  extract  and  reconstruct  the  experiment  data  to  conduct  analysis. 
A  variable  length  data  packet  with  tag  or  label  fields  for  each  group  of 
capacitor  data  would  be  more  efficient  and  would  make  it  easier  to 
positively  identify  the  data. 
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APPENDIX  A  -  FERRO  EXPERIMENT  HARDWARE  SCHEMATIC 

This  appendix  contains  the  schematic  for  the  FERRO  hardware.    The 
80C196KB  Microcontroller  and  the  82C55  Programmable  Periperheral 
Interface  are  shown  on  sheet  1.    Also  shown  on  sheet  1  is  the  chip  select 
logic,  the  clock  circuitry  and  the  A/D  converter  input  multiplexor  for  reading 
the  ferroelectric  capacitors. 

Sheet  2  shows  the  driver  amplifiers  and  switching  for  applying  read, 
write,  and  fatigue  pulses  to  the  capacitors.    The  sense  capacitors  and 
Sawyer-Tower  switches  for  DUTs  1  and  2  are  also  shown. 

Sheet  3  shows  the  sense  capacitors  and  Sawyer-Tower  switches  for 
DUTs  3  and  4.    The  temperature  sensing  circuitry  is  split  between  sheets  2 
and  3  as  are  the  DUT  select  multiplexers  for  reading  the  ferroelectric 
capacitors. 
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APPENDIX  B  -  FERRO  SOFTWARE  SOURCE  CODE 

The  source  code  for  the  FERRO  software  is  divided  in  to  several  files 
based  on  functional  area.    FERRO. H  contains  all  global  definitions  and 
macros  and  all  function  prototypes.    All  global  variables  are  declared  in 
GLOBALS.H.    INIT96.C  contains  all  of  the  initialization  routines,  while  the 
bulk  of  the  command  and  event  processing  routines  are  in  COMMAND. C. 
The  communication  routines  are  located  in  PACKET. C  and  CHECK. C. 
EXPER.C  contains  all  of  the  routines  to  read  and  write  to  the  ferroelectric 
capacitors  and  read  the  temperature  sensors. 
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APPENDIX  C  -  TEST/VERIFICATION  SOFTWARE  SOURCE  CODE 

The  test  and  verification  software  consists  of  two  header  files  and 
three  source  files.    SERIAL. H  contains  all  of  the  definitions  and  declarations 
necessary  to  initialize  and  use  the  RS-232  serial  port  on  an  IBM  PC 
compatible  computer.   The  routines  for  initializing  and  using  the  port  for 
communication  are  located  in  SERIAL. C. 

TERM.H  contains  the  definitions  and  declarations  for  the  main  portion 
of  the  test  and  verification  software.    Header  files  for  the  Ultra  Windows 
library  are  included  to  provide  definitions  and  declarations  to  support  the 
library  functions  used  to  implement  the  user  interface.    Constants  used  to 
define  the  FERRO  commands  and  packet  structure  are  also  defined  here. 

TERM.C  contains  the  routines  that  control  and  interact  with  the  user 
interface.   The  routines  to  display  menus  and  windows,  and  implement 
menu  selections  are  also  located  in  this  file.    The  routines  to  send,  receive 
and  display  packets  are  located  in  the  file  T  PACKET. C. 
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